chore: address Copilot review round 3 on #2200

Two suppressed comments, both accurate.

- Pin zod, zod/v4 and open to the root in vitest.shared.mts, and add matching
  paths to the three clients/web tsconfigs. The claim they replace — that these
  resolve unambiguously by walk-up — was wrong: both still sit at the top level
  of clients/web/node_modules as transitive copies (zod under
  eslint-plugin-react-hooks, open under Storybook), so an unpinned bare import
  from a web test resolved the client copy while core/ and the SDK packages
  resolved the root's. For open that is only wasteful; for zod it is a schema
  built by one copy and an instanceof check made by the other across the whole
  @modelcontextprotocol/* surface. zod is deduped as well, and zod/v4 gets its
  own entry because first-party code imports both specifiers and pinning one
  would split the package rather than collapse it.
- Update the consumer comments that #2195 falsified. clients/web/vite.config.ts
  (three places) and server/start-vite-dev-server.ts all still said the shared
  aliases resolve pino/hono and friends from clients/web/node_modules; they now
  state the split — react and react-dom from the client install, everything
  root-declared from the repo root.
- local-dev skill: replace the wrong 'resolves unambiguously' list with the
  distinction that actually matters. Deleting a declaration is not the same as
  the package resolving from the root, because chokidar, zod, open and react
  all sit in a client install transitively; check the install, not the manifest.
  ajv, commander and undici carry no pin because no client install has a copy.

npm run local:gate passes from a cold tsc build.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/tsconfig.node.json

@@ -55,7 +55,10 @@
       "@hono/node-server": ["../../node_modules/@hono/node-server"],
       "atomically": ["../../node_modules/atomically"],
       "chokidar": ["../../node_modules/chokidar"],
-      "@napi-rs/keyring": ["../../node_modules/@napi-rs/keyring"]
+      "@napi-rs/keyring": ["../../node_modules/@napi-rs/keyring"],
+      "zod": ["../../node_modules/zod"],
+      "zod/v4": ["../../node_modules/zod/v4"],
+      "open": ["../../node_modules/open"]
     }
   },
   "include": ["vite.config.ts", "tsup.runner.config.ts", "server/**/*.ts"]